Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    c49d2803464e2eecb118dc95776fabee0f3addd7ae31505c42a3bd839c973696

  • Size

    2.3MB

  • Sample

    240502-z9mr4ahe49

  • MD5

    51eb099e680eb872a3619c63edcfdc5a

  • SHA1

    3a2abc690a922190b9d5d61654068df37ea4d72a

  • SHA256

    c49d2803464e2eecb118dc95776fabee0f3addd7ae31505c42a3bd839c973696

  • SHA512

    bdac8e9e1ce5a2fd8709296d5279f7a31a97a1f81131a5f1b821203e2b4a23e925d80348a1988c8715a0d5209b36596bf74174108ecce5675f42d9550341b159

  • SSDEEP

    49152:CGY5918NqwTEgTcQUEnurFnLTHLpWGBM/OS7xpJBKn8Q/UgVR:ThTPUumfM/bBBO3/UeR

Score
10/10

Malware Config

Extracted

Family

risepro

C2

147.45.47.93:58709

Targets

    • Target

      c49d2803464e2eecb118dc95776fabee0f3addd7ae31505c42a3bd839c973696

    • Size

      2.3MB

    • MD5

      51eb099e680eb872a3619c63edcfdc5a

    • SHA1

      3a2abc690a922190b9d5d61654068df37ea4d72a

    • SHA256

      c49d2803464e2eecb118dc95776fabee0f3addd7ae31505c42a3bd839c973696

    • SHA512

      bdac8e9e1ce5a2fd8709296d5279f7a31a97a1f81131a5f1b821203e2b4a23e925d80348a1988c8715a0d5209b36596bf74174108ecce5675f42d9550341b159

    • SSDEEP

      49152:CGY5918NqwTEgTcQUEnurFnLTHLpWGBM/OS7xpJBKn8Q/UgVR:ThTPUumfM/bBBO3/UeR

    Score
    10/10
    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks